v0.1 Pre-release · open source, Apache 2.0
Your AI reads the queue.
You hold the key.
Let Claude Code, Codex, Cursor or Gemini CLI inspect your RabbitMQ brokers without ever handing them a password.
lockmq puts a human-held console between your AI agent and RabbitMQ. The agent asks; the console, running in a terminal you keep in view under its own account, holds the broker credentials and the only broker connections, serves an allowlist of read-only operations, masks personal data in messages and waits for your approval before any message content leaves it. The agent never sees a credential and never opens a connection.
- Linux and macOS
- amd64 and arm64
- RabbitMQ 3.13 and 4.x
- Management API, stream protocol, AMQP 0-9-1
- Apache 2.0
See it run
Swipe sideways to see both terminals.
alice) lists queues at once: a catalogue call needs no approval. Reading a stream stops in the lockmq console (right, account lockmq) until you type y; the messages come back masked, the customer's email as a <redacted:rN.K> reference.Why lockmq?
“Why does orders.failed fill up?” is a good question for an agent. Answering it means looking at queues, bindings, policies, consumers and, in the end, a few messages. Handing the agent rabbitmqctl, the management API or an admin password gives it every write too (purge, delete, publish, shovels), and every message body in clear. lockmq moves the key and the decision out of the agent.
| Property | Agent with credentials | lockmq |
|---|---|---|
| Agent never sees the broker password | No | Yes |
| Agent has no broker connection | No | Yes |
| Only an allowlist of read operations exists | No | Yes |
| Every message read approved by a human | No | Yes |
| Message bodies, headers and properties masked | No | Yes |
| Stream reads never store an offset | No | Yes |
| Queue peek off by default, never auto-approved, refused near the delivery limit | No | Yes |
| Policy loosening needs a human confirmation | No | Yes |
| Append-only audit log (never message content) | No | Yes |
See what you approve
When the agent asks to read a stream, the console shows you this screen and waits. Nothing is read until you approve; on a production profile you type the profile name, not y.
╭─ PROD · rabbitmq.example.com:15671 / orders · user lockmq-ro · tier read ─────
│ requested by uid 1000 (alice) · pid 48211 · process "lockmq" (self-reported name)
│ agent: see the order events around 10:42 to explain a missing confirmation
│
│ READ stream order-events from timestamp 2026-10-19T10:40:00Z max 20
│
│ stream: first offset 1200311 · last 1402977 · via stream protocol
│ no offset stored · no message removed
│ PII: masked (2 mask rules, 1 allow rules; body redact-unknown; detectors: card, email, iban, phone)
╰─ Type the profile name "prod" to approve:No answer within 5 minutes means denied.
Highlights
One key holder
Credentials are typed at console start, or read from the OS keychain or HashiCorp Vault. Never in argv, env, files, logs, the socket or error messages; URI passwords are stripped from every answer.
Catalogue first, no prompt
Overview and alarms, queues, one queue with its arguments, DLX, TTL, delivery limit and policy; exchanges, bindings, consumers, connections, channels, stream offsets and consumer lag.
Messages, approved
readreads a stream fromfirst,last, an offset or a timestamp with an unnamed consumer: nothing stored, nothing moved. You approve each read.Peek, only if you allow it
Reading a classic or quorum queue requeues messages. It exists only on a profile you set to tier
peek, is approved every time and refused near the delivery limit.Masking for messages
JSON bodies masked per leaf (
redact-unknownon production), headers and properties by rule and name, value detectors; binary bodies reduced to size and hash.OS separation
lockmq installruns the console under its own account; the kernel checks every peer on the socket.The AI tightens, the human loosens
The agent may add mask rules or tighten a profile; a new tier, limit, vhost or URL waits for your confirmation in the console.
Refusals the agent can act on
Every refusal carries a stable code, a hint and a retry rule: rewrite, ask the user, or stop.
Quick start
# 1. Install (see the Install page for packages, checksums and signatures)
curl -fsSL https://raw.githubusercontent.com/DavidGodefroid/lockmq/main/scripts/install.sh | sh
# 2. Separate the console from the agent (once per machine)
lockmq install
# 3. In your project: a broker profile, then your agents
lockmq setup
lockmq init
# 4. In a session of the lockmq account, start the console and keep it open
lockmq console --profile dev --project DIRThen ask your agent: “which queues have no consumer?”. Catalogue calls answer at once; message reads wait for your approval in the console. lockmq doctor checks the setup.
The lock family
Human-gated tools for AI agents, built on the same console, separation and approval model.
locksql
Databases: MariaDB, MySQL, PostgreSQL, SQLite. Your AI writes the query; you approve it.
lockmqYou are here
Message queues: RabbitMQ. Your AI reads the queue; you approve each message read.
lockfile
Files: your AI asks yes/no questions about a file it never reads.
lockkit
The shared Go framework: console, separation, approval, masking, audit, MCP.
Know the limits
The console is the enforcement point; skills and tool descriptions only guide the agent. Masking is best effort. A queue peek is not read-only (messages are requeued), so it is off unless you allow it on a profile. RabbitMQ lets the read permission purge a queue: lockmq never does, but grant read narrowly. v0.1 has no writes of any kind.